feat(mindspace): enforce PostgreSQL user data delivery

mindspace-sandbox-mcp.test.mjs

@@ -85,6 +85,41 @@ function startSandbox(root, envOverrides = {}) {
   return { child, request };
 }
 
+test('sandbox MCP rejects browser storage in generated page code', async (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'mindspace-sandbox-storage-ban-'));
+  const server = startSandbox(root, { ALLOWED_TOOLS: 'write_file,edit_file' });
+  t.after(() => server.child.kill());
+
+  await server.request('initialize');
+  const rejectedWrite = await server.request('tools/call', {
+    name: 'write_file',
+    arguments: {
+      path: 'public/ledger.html',
+      content: '<script>localStorage.setItem("ledger", "[]")</script>',
+    },
+  });
+  assert.equal(rejectedWrite.result.isError, true);
+  assert.match(rejectedWrite.result.content[0].text, /BROWSER_STORAGE_FORBIDDEN|禁止使用 localStorage/);
+  assert.equal(fs.existsSync(path.join(root, 'public', 'ledger.html')), false);
+
+  const acceptedWrite = await server.request('tools/call', {
+    name: 'write_file',
+    arguments: { path: 'public/ledger.html', content: '<script>client.insertRow("ledger", row)</script>' },
+  });
+  assert.equal(acceptedWrite.result.isError, false);
+
+  const rejectedEdit = await server.request('tools/call', {
+    name: 'edit_file',
+    arguments: {
+      path: 'public/ledger.html',
+      old_str: 'client.insertRow("ledger", row)',
+      new_str: 'indexedDB.open("ledger")',
+    },
+  });
+  assert.equal(rejectedEdit.result.isError, true);
+  assert.doesNotMatch(fs.readFileSync(path.join(root, 'public', 'ledger.html'), 'utf8'), /indexedDB/);
+});
+
 test('sandbox MCP exposes and protects the user private data space', async (t) => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'mindspace-sandbox-'));
   const server = startSandbox(root);